Examkin

Soru

Zorluk: Çok zorPublic Key Infrastructure and Certificate Management

An enterprise security administrator is resolving TLS handshake failures for internal client applications connecting to a critical web server in an isolated, air-gapped network segment. Clients are configured to require strict certificate revocation checks before trusting server certificates. Because client endpoints lack direct internet access or connection to internal revocation endpoints, standard Certificate Revocation List (CRL) downloads and direct Online Certificate Status Protocol (OCSP) queries fail, causing clients to terminate mTLS negotiations. Which of the following solutions should the administrator implement on the web server to resolve the revocation verification failure while maintaining real-time revocation assurance?

  1. Enable OCSP stapling (TLS Certificate Status Request extension) on the web server so it periodically fetches and appends a time-stamped, CA-signed revocation status response directly to the client during the TLS handshake.Cevap
  2. B
    Generate a new Certificate Signing Request (CSR) containing an embedded symmetric session key and re-issue the certificate across the trust chain.
  3. C
    Reorder the PKI lifecycle workflow to generate the public key on the Certificate Authority (CA) prior to CSR submission so revocation checks bypass the client.
  4. D
    Replace digital signatures on the certificate with hashing algorithms to enforce non-repudiation during data-at-rest encryption validation.

Cevap

Enable OCSP stapling on the web server so that a cached, CA-signed revocation status response is delivered to clients directly within the TLS handshake.
OCSP stapling (defined in RFC 6066 as the TLS Certificate Status Request extension) enables the web server to query the CA OCSP responder periodically and cache the time-stamped, cryptographically signed response. When clients initiate a TLS connection, the server includes this stapled response in the TLS handshake. This allows isolated clients to verify that the server certificate has not been revoked without requiring direct network access to external OCSP responders or downloading large CRL files.

Adım Adım Çözüm

1
Analyze the constraint preventing client-side revocation validation.
Identified that client endpoints reside in an isolated network segment without direct connectivity to CRL distribution points or OCSP responders, causing revocation lookups to fail.
When strict revocation checking is enabled, inability to query revocation status forces compliant clients to reject the server certificate.
2
Evaluate revocation mechanisms that satisfy isolated network client requirements.
Selected OCSP stapling, which offloads the query responsibility to the web server.
The web server queries the CA's OCSP responder on a set interval, receives a signed and time-stamped status assertion, and staples this response into the server's TLS Certificate Status Request extension.
3
Verify client trust and bandwidth efficiency.
Clients validate the stapled OCSP response using the CA's trusted public key already present in their local trust store without originating external connections.
This eliminates bandwidth overhead and resolves connectivity limitations in restricted client environments while retaining real-time revocation integrity.

Anahtar Kavram

OCSP Stapling and Certificate Revocation Management
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Public Key Infrastructure and Certificate Management

Bu konudan daha fazla soru